Penetration Testing vs Vulnerability Scanning: Differences and Costs

What a Vulnerability Scan Reveals

An automated scan compares software versions, configurations and known vulnerabilities (CVEs) against a threat database. It produces a list of technical weaknesses: outdated libraries, missing patches, weak default passwords, open ports or misconfigured HTTP headers. The output is a report with hundreds of items sorted by CVSS score. A scan cannot assess context, for example whether a flaw in an internal system is reachable from the internet, or whether multiple weaknesses can be chained into a successful attack. A typical case: a scan flags a critical vulnerability in a web server but does not tell you that it is protected by a WAF and network segmentation.

What a Penetration Test Adds

A penetration tester manually verifies whether discovered weaknesses can be exploited and looks for logical errors that scanners miss: missing authorisation in APIs, weak identity verification, privilege escalation after a normal user logs in. The test covers resistance to social engineering, bypassing controls and data exfiltration. The deliverable is an attack scenario with evidence (screenshots, logs) and concrete remediation steps. In practice, CIAD (the Czech Institute for AI and Data) has found cases where a scan detected no critical flaw in an e-shop, yet a penetration test revealed that changing an order parameter allowed reading other customers’ payments, a logical error with no CVE identifier.

When to Commission Each and Typical Costs

Vulnerability management means regular (weekly or monthly) automated scanning of the entire infrastructure. It serves as continuous hygiene and satisfies requirements of standards such as ISO 27001 and NIS2. In the Czech Republic the cost ranges from 50 to 200 thousand CZK annually depending on the number of IP addresses and scan frequency. A penetration test is a one-off or annual engagement for key applications, before production deployment, after major changes or for audit purposes. The price in the Czech Republic ranges from 150 to 600 thousand CZK depending on scope (web, API, internal network, physical security, social engineering). The two approaches complement each other: scanning covers breadth and volume, penetration testing covers depth and impact. Plan a penetration test after critical findings from regular scans have been remediated, not as a substitute for scanning.

Choosing a Provider

Check references from your sector (banking, healthcare, e-commerce). Request a sample report, it must contain reproducible steps, not just a list of CVEs. Ask about methodologies (OSSTMM, PTES, OWASP WSTG) and team certifications (OSCP, CRTO, eCPPT). Contractually define scope, rules of engagement, time windows and the procedure if an active attack or data leak is discovered during testing. Avoid providers offering a “penetration test” at the price of a scan; often this is only manual validation of scanner output.

What This Means for Security Teams

A scan tells you what is broken; a penetration test tells you what happens when an attacker exploits it. Organisations in the Czech Republic need both: scanning as a permanent hygiene control, penetration testing as a regular review of the resilience of critical assets. The same principle applies across the EU where NIS2 and ISO 27001 drive comparable requirements.